A face recognition time clock stops buddy punching on the day it goes live. It can also create a liability the same day if nobody collected the right notice and consent first. Illinois has produced thousands of biometric lawsuits since 2015, most of them over time clocks.
This guide is for ops heads, HR managers, and payroll leads running hourly crews across US job sites. It covers BIPA compliance in Illinois, the parallel statutes in Texas and Washington, what Colorado, New York, and California add, and how to run one biometric policy across all of them without tracking which crew crossed which state line.
What is BIPA compliance?
BIPA compliance is meeting the requirements of the Illinois Biometric Information Privacy Act (740 ILCS 14) before, during, and after collecting a biometric identifier such as a face or fingerprint scan. It applies to any private entity that collects biometric data from an Illinois resident, employee or otherwise, regardless of where the company is headquartered.
The term has spread beyond Illinois. HR teams and vendors say “BIPA compliance” when they mean biometric compliance in any state, because Illinois is the statute that produces lawsuits. Strictly, BIPA is Illinois only. Texas, Washington, and Colorado have their own statutes with their own names, and California regulates biometrics inside its general privacy law.
What matters for a time clock is that every one of these laws treats a face template the same way: a scan of face geometry used to identify a person is a biometric identifier. A photograph is not. The moment the photo is converted into a template that the clock matches against, it is.
A facility management company that enrolls 200 cleaning staff on a face clock across buildings in Chicago, Dallas, and Seattle has triggered three different statutes with three different enforcement models on one enrollment day.
Which states require consent before a biometric time clock scan?
Three states have standalone statutes that regulate biometric identifiers directly and require notice and consent before collection: Illinois, Texas, and Washington. Colorado joined them on July 1, 2025 through an amendment to its privacy act. California regulates biometrics as sensitive personal information under the CCPA, and New York bars employers from requiring fingerprints as a condition of employment.
The three consent states are mandatory in a specific sense: in Illinois, Texas, and Washington, the statute reaches the biometric template itself, regardless of company size or revenue. The CCPA, by contrast, applies only above its thresholds, and Colorado’s amendment applies regardless of the CPA’s volume thresholds. If your crews touch Illinois, Texas, or Washington, there is no size exemption to hide behind.
A payroll manager at a staffing agency placing workers in all three states does not get to pick a favorite statute. The practical answer is to build to the strictest one, Illinois, and apply it everywhere.
What does Illinois BIPA require for a face recognition time clock?
Illinois requires five things before and during the use of a biometric time clock: written notice to the worker of what is collected, why, and for how long; a written release signed by the worker; a publicly available written retention and destruction policy; no sale, lease, or trade of the data; and the same standard of care used for other confidential information.
Notice and release. The worker must be told in writing that a biometric identifier is being collected, the specific purpose, and the length of time it will be stored and used. The worker then signs a written release. Since Public Act 103-0769 took effect on August 2, 2024, an electronic signature counts, and in the employment context a release executed as a condition of employment is valid.
Retention policy. The policy must set a retention schedule and guidelines for destroying the data when the initial purpose is satisfied or within three years of the worker’s last interaction with the company, whichever comes first. It must be made available to the public, which in practice means a page on your website or a document in the onboarding pack.
No disclosure. The data may not be disclosed to a third party without consent, unless a law or subpoena requires it or the disclosure completes a financial transaction the worker requested. A vendor processing the template on your behalf under contract is the expected exception; a vendor using it for anything else is not.
Damages. A worker can sue directly and recover $1,000 per negligent violation or $5,000 per intentional or reckless violation, plus attorneys’ fees. The 2024 amendment counts repeated scans of the same person by the same method as one violation with one recovery, which reversed the 2023 Illinois Supreme Court reading that made every scan a separate claim. The exposure is still per worker: a 300-person crew enrolled without releases is 300 claims.
A general contractor running a Chicago high-rise with four subcontractors and a labor broker can see 150 new enrollments in a month. If the general contractor operates the clock, the general contractor is collecting the data, and the release has to come from each worker to the general contractor at the gate, not from a clause in the subcontract.
What does the Texas biometric privacy law require?
Texas requires a company to inform the person before capturing a biometric identifier for a commercial purpose and to obtain consent, under Business and Commerce Code Section 503.001, commonly called CUBI. There is no private right of action; the Attorney General enforces it with civil penalties of up to $25,000 per violation.
Three provisions matter for an employer running a face clock:
The 2025 amendment that took effect on January 1, 2026 added exemptions for AI model training and for AI systems used to detect fraud or security incidents. Neither exemption reaches a time clock, because the statute keeps coverage for any system “used or deployed for the purpose of uniquely identifying a specific individual.” That is exactly what an attendance clock does.
A logistics operator with warehouses in Houston and San Antonio should treat Texas consent as a condition of enrollment and set template deletion to run twelve months after separation at the latest.
What does the Washington biometric privacy law require?
Washington prohibits enrolling a biometric identifier in a database for a commercial purpose without first giving notice, obtaining consent, or providing a mechanism to prevent later commercial use, under RCW 19.375. The Attorney General enforces it through the Consumer Protection Act; there is no private right of action.
Two features make Washington different from Illinois and Texas. First, “commercial purpose” is defined narrowly as furthering the sale or disclosure of the identifier to a third party for marketing unrelated to the original transaction. Second, enrollment for a security purpose, which the statute defines to include preventing fraud and misappropriation, is expressly carved out of the notice and consent duty.
An attendance clock run by an employer that never sells or shares the template may therefore sit outside the operative rule. The retention and reasonable-care duties still apply to anyone who possesses an enrolled identifier, and the statute bars using it in a way materially inconsistent with the purpose it was enrolled for.
The practical rule for a multi-state employer: give Washington workers the same notice and collect the same acknowledgment as everywhere else. It costs nothing, it removes the argument about whether your use was commercial, and it keeps one enrollment flow across all sites.
What do Colorado, New York, and California add?
Colorado requires notice, consent, and a public written policy for any employer that collects employee biometrics; New York bars requiring fingerprints as a condition of employment; and California treats face templates as sensitive personal information with notice, data rights, security, and, since 2026, a risk assessment duty.
Colorado. HB24-1130 amended the Colorado Privacy Act effective July 1, 2025 and applies to any controller of biometric identifiers regardless of the CPA’s volume thresholds. It requires a public written policy with a retention schedule and an incident response protocol, written notice and consent before collection, and no sale or lease of the data. Deletion runs when the purpose is satisfied, one year after the last interaction, or within 30 days of a verified request, whichever is first.
For employers, the amendment lists the purposes for which consent may be required as a condition of employment, and recording the start and end of a worker’s full work day, including meal and rest breaks, is one of them. Consent for any other purpose must be voluntary, and the employer may not retaliate for refusing it.
New York. Labor Law Section 201-a prohibits requiring an employee to be fingerprinted as a condition of securing or continuing employment, with exceptions for roles where another law requires it. A voluntary fingerprint clock has been treated as permitted, but a crew that can decline needs a second clock-in method anyway, which is why contractors with New York sites tend to choose face recognition. New York City’s separate biometric identifier law covers customers of commercial establishments, not employees.
California. The CCPA classifies a face template used for identification as sensitive personal information. Covered employers owe notice at collection, access and deletion rights, reasonable security, and, under the regulations effective January 1, 2026, a documented risk assessment before processing. From January 1, 2027, AB 1883 also bars AI workplace tools that infer emotional state, which a clock verifying identity does not do. The California biometric privacy law guide covers the CCPA thresholds, the 2027 laws, and the penalties in detail.
Everywhere else. Most other state privacy laws classify biometric data as sensitive but exempt employee data, and there is no federal biometric privacy statute. The Federal Trade Commission has acted against unfair biometric practices under its general authority, which is a reason to keep the same notice and security discipline in states with no statute at all.
Is facial recognition legal for employee attendance in the US?
Yes, in every state. No state or federal law bans a private employer from using face recognition to verify who is clocking in. The laws above regulate how the template is collected, stored, used, and destroyed; none of them prohibits the use.
Two limits sit next to that answer. A unionized workforce may require bargaining before a biometric clock is introduced, since timekeeping methods are a term of employment. And a worker who declines consent where the law makes consent voluntary, or who cannot be fingerprinted in New York, needs a documented fallback such as a supervisor-witnessed clock-in, so the refusal does not reopen the buddy punching the clock was bought to close.
A site superintendent at an electrical contractor with crews in Illinois, Texas, and Colorado can run one face clock across all three. The difference is paperwork, and the paperwork is the same in all three if it is written to the Illinois standard.
What should a multi-state rollout do before the first scan?
Build one biometric policy to the Illinois standard and apply it in every state, because a policy that satisfies BIPA also satisfies Texas, Washington, Colorado, and the CCPA’s notice and retention duties. Seven steps, in order:
A payroll manager who does this once, for all sites, spends less than the cost of tracking which of 400 workers are Illinois residents this quarter.
Why do multi-site crews and subcontractors make BIPA compliance harder?
Because every statute attaches to the entity that collects the data and to each individual worker, and multi-site field operations multiply both. A single office enrolls one workforce once. A contractor running crews across a dozen sites enrolls new workers every week through subcontractors, staffing agencies, and labor brokers, at gates with no HR presence, on shared devices.
Who collects the consent. If your company operates the clock, your company is the collector under Illinois, Texas, and Colorado law, even for workers employed by a sub. The release must come from the worker to you.
Residency, not site location. BIPA protects Illinois residents. A worker who lives in Illinois and is sent to a Wisconsin site may still be protected. Tracking residency per worker is impractical; applying the Illinois standard everywhere is not.
Turnover and deletion. A framing sub that finishes in March may never return. An enrolled template from a worker who left eight months ago is the record that turns into a claim. Deletion has to be tied to the end of the sub’s scope, not to the end of your contract with the sub.
Shared devices. A site tablet used by 80 workers is one device with access to 80 templates. Device encryption and role-based access matter more than they do on a personal phone.
Workers who decline. Some will. The fallback and the record of it are part of the compliance program, not an exception to it.
A general contractor with four subs and a labor broker on one Illinois site can have 150 new enrollments in a month. Handling notice, release, and deletion at the clock, rather than in five separate subcontract files, is the difference between a program and a liability.
What should you look for in a BIPA-compliant face recognition time clock?
Look for a clock that delivers notice and captures a release inside enrollment, stores templates rather than images, deletes on a schedule you set, logs every enrollment and request, scopes access by role and contractor, signs service provider terms, and verifies identity without inferring anything else.
An HR director evaluating vendors should treat a vague answer on raw image storage, deletion, or release logging as a disqualifier, because each maps to a statutory duty that cannot be delegated. The face recognition attendance system buyer’s guide covers the identity verification mechanism, offline reliability, and contractor management in depth, and the construction biometric time clock guide covers which biometric survives gloves, dust, and worn hands.
How does Truein support BIPA compliance?
Truein is a face recognition and GPS-based time and attendance platform for contract and multi-site workforces, with more than 500 customers across 10,000 locations and 500,000 workers. Face-verified clock-in runs on any Android or iOS phone or tablet, with no dedicated hardware, and the platform is built around the duties the statutes above impose.
Compliance still depends on how your organization configures and runs it. Truein supplies the controls; the policy, notice text, and releases your state requires are yours to set, and counsel should approve them.
Consent before collection. Workers see a consent screen in the Truein app and must actively tap to agree before the camera opens. The step is configurable in admin settings and enforced across every site from one place.
No raw image storage. After enrollment, Truein generates a mathematical template and discards the original image. The template is what verifies identity at each clock-in.
Identity verification, not inference. Truein uses AI to match a face at clock-in and to flag spoofing attempts such as a photo held to the camera. It does not train models on customer data and does not infer emotional state.
Your data stays yours. Truein processes attendance data as a service provider on your behalf and does not sell, share, or use it beyond running the attendance service.
Tested security. ISO 27001 and SOC 2 certifications, encryption at rest and in transit, regular penetration testing, and a dedicated Data Protection Officer and Chief Information Security Officer.
Deletion and retention controls. Templates and associated records can be removed when a worker leaves or a validated request arrives, with configurable retention schedules.
Contractor-scoped access. Subcontractor and agency crews run under one account, with each agency’s supervisor seeing only their own workers, which keeps enrollment, consent records, and deletion organized by contractor rather than scattered across subcontract files. The face recognition attendance system page covers the setup for gates, site tablets, and supervisor devices.
For companies managing crews across Illinois, Texas, Washington, Colorado, and California sites, Truein is designed to support the notice, consent, retention, and vendor duties those states impose. Whether it meets your specific requirements depends on your deployment and the policy work around it.
Conclusion
BIPA compliance is the strictest standard in the country, which is exactly why it is the right one to build to. Write one biometric policy to the Illinois rules, deliver one notice inside enrollment, collect one release, delete on one schedule, and the same program satisfies Texas, Washington, Colorado, and California’s notice and retention duties without anyone tracking crews across state lines.
For companies managing contract and field crews across multiple job sites, face recognition remains legal in every state; the law shapes the rollout rather than stopping it.
Get the policy and notice in place before go-live, choose a clock that does identity verification and nothing more, and schedule a demo to see how Truein handles consent, deletion, and contractor-scoped access across multi-state crews.
Frequently asked questions
Which states have biometric privacy laws that apply to employee time clocks?
Illinois, Texas, and Washington have standalone biometric statutes that require notice and consent before collection. Colorado added biometric consent and policy requirements to its privacy act effective July 1, 2025. California regulates face templates as sensitive personal information under the CCPA, and New York bars requiring fingerprints as a condition of employment. Most other state privacy laws exempt employee data.
Does BIPA apply to a company outside Illinois?
Yes, if it collects biometric data from an Illinois resident. BIPA protects people, not addresses, so a Missouri contractor that enrolls an Illinois-resident worker on a face clock at a St. Louis site can be sued under BIPA. Headquarters location does not matter, and company size does not matter either, because the statute has no revenue or headcount threshold.
What is the penalty for violating BIPA?
A worker can recover $1,000 per negligent violation or $5,000 per intentional or reckless violation, plus attorneys’ fees, through a direct lawsuit or class action. Since the August 2, 2024 amendment, repeated scans of the same person by the same method count as one violation with one recovery, but every worker enrolled without a release is still a separate claim.
Is a face recognition time clock legal in Texas?
Yes, provided the employer informs the worker before capture and obtains consent, protects the identifier with reasonable care, does not sell or disclose it except as the statute allows, and destroys it within a year of the purpose ending, which for employees is presumed to be termination. The Attorney General enforces the law with civil penalties of up to $25,000 per violation; there is no private lawsuit.
Do I need written consent for a biometric time clock in Washington?
Washington requires notice, consent, or an opt-out mechanism before enrolling a biometric identifier for a commercial purpose, which the statute defines narrowly around selling or disclosing the identifier for marketing. An employer that never sells the template may fall outside that rule, and a security purpose is carved out. The safe practice is to give the same notice and collect the same acknowledgment as in Illinois.
Can an employee refuse to use a biometric time clock?
In Illinois and Texas, consent is required, so a worker can decline, and the employer needs a documented alternative such as a supervisor-witnessed clock-in. In Colorado, consent for recording the start and end of the work day may be made a condition of employment. In New York, fingerprinting cannot be required, though face recognition is not covered by that rule. In California, there is no statutory opt-out from identity verification at clock-in.
References
Official sources only. Verified live on November 4, 2026.
Disclaimer: This article is for general informational purposes only and does not constitute legal advice. State biometric privacy laws change, and their application to employee data varies by statute and by the facts of each deployment. Consult qualified legal counsel to confirm your obligations before rollout.
